This notice concerns personal data shared through the MandarinDent Bodrum contact form and provides information under Türkiye’s Personal Data Protection Law No. 6698 (“the Law”).

Depending on the fields you complete, the form collects:

• Your first name and last name.
• Your email address.
• Your telephone or WhatsApp number.
• Your country of residence, if provided.
• The dental treatment you are interested in.
• Your message and the information you choose to include.
• A record of your acknowledgement of the privacy notice.

Your treatment selection and information about your dental concerns may reveal health information and may therefore constitute special categories of personal data.

Please share only what is needed for your initial enquiry. Do not submit identity documents, detailed medical reports or X-rays through this contact form. If further health information is needed, please discuss an appropriate communication method with the clinic.

To be completed: Identify the technical information actually recorded by the form, hosting environment and security tools, including any IP addresses, submission timestamps and security logs.

Information submitted through the contact form is used to manage your enquiry and related communication. These purposes include:

• Receiving and reviewing your enquiry.
• Responding using the contact details you provide.
• Communicating about an appointment you request.
• Following up on correspondence related to your request.

Where necessary, relevant records may also be processed to fulfil legal obligations or to establish, exercise or protect a right, limited to those purposes.

Submitting a contact enquiry does not constitute consent to receive advertising or marketing messages. Any such communications require the applicable conditions to be met separately.

Personal data is collected electronically when you complete and submit the website contact form.

To be completed: Match each actual processing purpose and data category to the applicable legal ground. Depending on the activity, Article 5(2)(c) may be relevant to appointment requests directly related to entering into or performing a contract, and Article 5(2)(e) may be relevant to records necessary to establish, exercise or protect a right. If Article 5(2)(f) is relied upon for general enquiries, necessity and the balance of interests must be assessed. These grounds must not be applied collectively to all data.

Health data requires a separate assessment under Article 6 of the Law. The conditions applicable to ordinary personal data do not, on their own, establish a ground for processing health data.

To be completed: State the actual purpose and applicable Article 6 condition for processing health information. A condition relating to healthcare activities carried out by persons subject to confidentiality obligations should be used only where the activity falls within that scope. Where explicit consent is required, it must be obtained separately and appropriately.

This section must identify who can access the submitted information, why it is shared and whether any processing involves a transfer outside Türkiye.

To be completed — recipients: List the actual recipient groups and transfer purposes. Review hosting, form administration, email delivery, notification recipients and technical maintenance. Include a provider only where it actually has access to the relevant data. Explain any disclosures to competent authorities and their grounds.

To be completed — international transfers: Review the hosting location, email services, Google reCAPTCHA and any other external services used. Where international transfers take place, identify the recipients, purposes and applicable transfer arrangements under Article 9 of the Law. This draft does not confirm that international transfers are absent or that safeguards have already been established.

Retention periods must reflect the nature of the enquiry, the purpose of processing and applicable legal obligations. When the conditions for processing no longer apply, personal data is deleted, destroyed or anonymised in accordance with applicable legislation.

To be completed: Specify the retention periods or criteria actually applied to form submissions, notification emails, related correspondence and backups.

The data controller must implement appropriate technical and organisational measures to protect personal data. Any additional measures required for health data must be assessed separately.

Under Article 11 of the Law, you may:

• Learn whether your personal data is being processed.
• Request information about processing that has taken place.
• Learn the purpose of processing and whether your data is used in accordance with that purpose.
• Learn the third parties to whom your data is transferred within Türkiye or abroad.
• Request correction of incomplete or inaccurate data.
• Request deletion or destruction where the legal conditions are met.
• Request notification of correction, deletion or destruction to third parties to whom the data has been transferred.
• Object to a result against you arising exclusively from automated analysis.
• Seek compensation for damage caused by unlawful processing of your personal data.

Applications may be submitted to Bodrum BRC Sağlık Hizmetleri San. ve Dış Ticaret LTD.ŞTİ. using the methods specified in the Communiqué on the Principles and Procedures for Applications to the Data Controller.

Postal address:
Yokuşbaşı Mh. Hasan Reşat Öncü Cd. No:16, Bodrum / Muğla, Türkiye

For information about application methods, contact info@mandarindent.com . Applications by email must meet the conditions set out in the Communiqué.

Acknowledging that you have read this notice does not constitute general explicit consent to processing your personal data for every purpose, processing health data or transferring data abroad. The applicable legal conditions must be met separately for each relevant activity.

Contact form acknowledgement:

I have read the Privacy Policy and understand that MandarinDent will use the information I submit to respond to my enquiry.